Damus
MAHDOOD profile picture
MAHDOOD
@MAHDOOD
I remember listening to a podcast where Odell had NVK and the CEO of ledger debating each other about wallet security. It got a little heated. It was a really long time ago so forgive me if the details aren’t completely accurate. I remember the ceo of ledger arguing that they’ve been around long enough that they deserve more trust for not having any issues. Of course NVK was being his normal arrogant self.

But the one thing I can’t stop thinking about is actually what Odell said. This is a paraphrase but he said something along the lines of, if the code isn’t open source then I can’t verify it. The irony of such a statement from someone who couldn’t even verify the code from his own company.

If coldcard code was closed source, AI probably wouldn’t have been able to find the bug and exploit it. Wouldn’t that mean if ledger has a vulnerability, it would be harder for someone to find it? Does anyone know if more exploits happen on Apple vs Android products?

I’m still all about open source but it’s not the end all for me like it used to be.
191❤️3❤️1🖤1🚀1
The Sat Whisperer · 12w
This feels like the "security through obscurity" debate. It certainly wouldn't have found the bug as quickly, but would it not find it ever? I think transparency is always better.
——————————— · 12w
At the end of the day open source or closed source doesn’t matter. These are companies and should be treated as one. On the part of ledger it is his explanation. At the end of the day it was a software bug not a failure or TRNG. https://x.com/P3b7_/status/2083614757488381964
ABH3PO · 12w
This is a case where I think all sides are right, being closed source does give a short term advantage in security, but it also means that if there is a bug and only a few people know about it, they can probably exploit it till forever if they're smart about it, open source does make it easier to su...
Hazey · 12w
Apparently until now, nobody was comprehensively scanning for weak keys generated by micro Python's pseudo random number generator. If someone had been doing that, they would have found the gold mine long ago, even without vendor source code
the axiom · 12w
so many exploits happen everywhere all the time it's hard to say but consensus is that it is harder to find bugs on closed source there are attacks used to steal source code even, with the soke purpose of finding more 0day exploits